Just to know, would it be thinkable to include in the ROM some build-in firewall (like afwall+) (within the system, with the good right, there's no need to get root), or is it forbidden by android license / impossible to make ?That would be a huge commercial advantage for your phones.

Yes. Just follow this procedure. Sorry I don't have time to write a super detailed one but you only need to search this forum for SP Flash Tool and how to use it (install drivers, extract boot, reflash boot).